CVE-2024-36512: Fortinet FortiAnalyzer Path Traversal Flaw

CVE-2024-36512 Overview

CVE-2024-36512 is a path traversal vulnerability [CWE-22] affecting Fortinet FortiManager and FortiAnalyzer. The flaw stems from improper limitation of a pathname to a restricted directory in the management interfaces. Authenticated attackers with high privileges can execute unauthorized code or commands using crafted HTTP or HTTPS requests. Fortinet published Security Advisory FG-IR-24-152 documenting the affected versions and remediation guidance.

Critical Impact
An authenticated attacker sending crafted HTTP or HTTPS requests can execute arbitrary code or commands on affected FortiManager and FortiAnalyzer instances, compromising confidentiality, integrity, and availability of centralized network management infrastructure.

Affected Products

Fortinet FortiManager and FortiAnalyzer 7.4.0 through 7.4.3
Fortinet FortiManager and FortiAnalyzer 7.2.0 through 7.2.5, and 7.0.2 through 7.0.12
Fortinet FortiManager and FortiAnalyzer 6.2.10 through 6.2.13

Discovery Timeline

2025-01-14 - CVE-2024-36512 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-36512

Vulnerability Analysis

The vulnerability resides in HTTP and HTTPS request handling within FortiManager and FortiAnalyzer management interfaces. Input parameters that reference file paths are not properly constrained to the intended directory. Attackers supply traversal sequences to reach files outside the permitted scope. The processing logic then acts on the resolved path, enabling execution of unauthorized code or commands.

Successful exploitation grants control over the management appliance. FortiManager and FortiAnalyzer centralize configuration and log aggregation for Fortinet fabrics, so compromise can cascade to downstream FortiGate firewalls and monitored assets. The vulnerability requires authentication with high privileges but no user interaction. The network attack vector and low attack complexity increase the practical exposure of internet-reachable or lateral-movement-reachable instances.

Root Cause

The root cause is insufficient validation and canonicalization of pathname input received through HTTP or HTTPS request parameters. The application accepts path segments that traverse directory boundaries. Fortinet classifies this under CWE-22: Improper Limitation of a Pathname to a Restricted Directory.

Attack Vector

An authenticated attacker submits crafted HTTP or HTTPS requests to the FortiManager or FortiAnalyzer management interface. The malicious request embeds traversal sequences within a path parameter. The vulnerable handler resolves the path outside the restricted directory, leading to unauthorized code or command execution in the appliance context.

Refer to the Fortinet Security Advisory FG-IR-24-152 for the vendor's technical description.

Detection Methods for CVE-2024-36512

Indicators of Compromise

HTTP or HTTPS requests to FortiManager or FortiAnalyzer management endpoints containing traversal sequences such as ../, ..\, or URL-encoded variants like %2e%2e%2f.
Unexpected process execution, file writes, or configuration changes on FortiManager or FortiAnalyzer appliances originating from authenticated administrative sessions.
Anomalous outbound connections or new administrative accounts appearing on centralized management appliances after receipt of crafted requests.

Detection Strategies

Review web server and management interface logs for path parameters containing directory traversal patterns or encoded equivalents.
Correlate authenticated administrative sessions with subsequent process execution or unusual file system activity on the appliance.
Compare current appliance file system state and running configuration against known-good baselines to identify unauthorized modifications.

Monitoring Recommendations

Forward FortiManager and FortiAnalyzer audit logs to a centralized SIEM for continuous inspection of administrative activity.
Alert on failed and successful logins to management interfaces from unexpected source addresses or during off-hours.
Monitor for creation or modification of system binaries, scripts, and cron entries on management appliances.

How to Mitigate CVE-2024-36512

Immediate Actions Required

Upgrade FortiManager and FortiAnalyzer to a fixed release per Fortinet advisory FG-IR-24-152.
Restrict network access to management interfaces so only trusted administrative networks can reach the appliance.
Audit administrative accounts, rotate credentials, and remove unused high-privilege accounts that could be leveraged in exploitation.

Patch Information

Fortinet has published fixed releases for affected branches. Consult FG-IR-24-152 for the specific target versions corresponding to each affected release line (6.2.x, 7.0.x, 7.2.x, 7.4.x). Apply the vendor-recommended upgrade path for your deployment.

Workarounds

Limit management interface exposure to dedicated management VLANs or jump hosts and block direct access from user or internet-facing networks.
Enforce multi-factor authentication for all administrative accounts on FortiManager and FortiAnalyzer to reduce the risk of credential-based exploitation.
Apply least-privilege role assignments so operators do not hold the elevated privileges required to trigger the vulnerable code paths.

bash

# Example: restrict management access via trusted hosts on FortiManager/FortiAnalyzer
config system admin user
  edit "admin"
    set trusthost1 10.0.0.0 255.255.255.0
    set trusthost2 0.0.0.0 0.0.0.0
  next
end